Karrio Auth API

openapi: 3.2.0
info:
  description: 'Karrio is a multi-carrier shipping API that simplifies the integration of logistics carrier services.


    The Karrio API is organized around REST. Our API has predictable resource-oriented URLs, accepts JSON-encoded

    request bodies, returns JSON-encoded responses, and uses standard HTTP response codes, authentication, and verbs.


    The Karrio API differs for every account as we release new versions.

    These docs are customized to your version of the API.


    ## Versioning


    When backwards-incompatible changes are made to the API, a new, dated version is released.

    The current version is `2024.12.6`.


    Read our API changelog to learn more about backwards compatibility.


    As a precaution, use API versioning to check a new API version before committing to an upgrade.


    ## Environments


    The Karrio API offer the possibility to create and retrieve certain objects in `test_mode`.

    In development, it is therefore possible to add carrier connections, get live rates,

    buy labels, create trackers and schedule pickups in `test_mode`.


    ## Pagination


    All top-level API resources have support for bulk fetches via "list" API methods. For instance, you can list addresses,

    list shipments, and list trackers. These list API methods share a common structure, taking at least these

    two parameters: limit, and offset.


    Karrio utilizes offset-based pagination via the offset and limit parameters.

    Both parameters take a number as value (see below) and return objects in reverse chronological order.

    The offset parameter returns objects listed after an index.

    The limit parameter take a limit on the number of objects to be returned from 1 to 100.


    ```json

    {

    "count": 100,

    "next": "/v1/shipments?limit=25&offset=50",

    "previous": "/v1/shipments?limit=25&offset=25",

    "results": [

    { ... },

    ]

    }

    ```


    ## Metadata


    Updateable Karrio objects—including Shipment and Order have a metadata parameter.

    You can use this parameter to attach key-value data to these Karrio objects.


    Metadata is useful for storing additional, structured information on an object.

    As an example, you could store your user''s full name and corresponding unique identifier

    from your system on a Karrio Order object.


    Do not store any sensitive information as metadata.


    ## Authentication


    API keys are used to authenticate requests. You can view and manage your API keys in the Dashboard.


    Your API keys carry many privileges, so be sure to keep them secure! Do not share your secret

    API keys in publicly accessible areas such as GitHub, client-side code, and so forth.


    Authentication to the API is performed via HTTP Basic Auth. Provide your API token as

    the basic auth username value. You do not need to provide a password.


    ```shell

    $ curl https://instance.api.com/v1/shipments \

    -u key_xxxxxx:

    # The colon prevents curl from asking for a password.

    ```


    If you need to authenticate via bearer auth (e.g., for a cross-origin request),

    use `-H "Authorization: Token key_xxxxxx"` instead of `-u key_xxxxxx`.


    All API requests must be made over HTTPS.

    API requests without authentication will also fail.'
  title: Karrio Auth API
  version: 2024.12.6
tags:
- name: Auth
  description: API authentication resources.
paths:
  /api/token:
    post:
      operationId: '&&authenticate'
      description: Authenticate the user and return a token pair
      summary: Obtain auth token pair
      tags:
      - Auth
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenObtainPair'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenPair'
          description: ''
  /api/token/refresh:
    post:
      operationId: '&&refresh_token'
      description: Authenticate the user and return a token pair
      summary: Refresh auth token
      tags:
      - Auth
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRefresh'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenPair'
          description: ''
  /api/token/verified:
    post:
      operationId: '&&get_verified_token'
      description: Get a verified JWT token pair by submitting a Two-Factor authentication code.
      summary: Get verified JWT token
      tags:
      - Auth
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifiedTokenObtainPair'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenPair'
          description: ''
  /api/token/verify:
    post:
      operationId: '&&verify_token'
      description: Verify an existent authentication token
      summary: Verify token
      tags:
      - Auth
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenVerify'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                additionalProperties: {}
          description: ''
components:
  schemas:
    TokenObtainPair:
      type: object
      properties:
        email:
          type: string
          writeOnly: true
        password:
          type: string
          writeOnly: true
      required:
      - email
      - password
    TokenRefresh:
      type: object
      properties:
        refresh:
          type: string
        access:
          type: string
          readOnly: true
      required:
      - access
      - refresh
    TokenPair:
      type: object
      properties:
        access:
          type: string
        refresh:
          type: string
      required:
      - access
      - refresh
    TokenVerify:
      type: object
      properties:
        token:
          type: string
          writeOnly: true
      required:
      - token
    VerifiedTokenObtainPair:
      type: object
      properties:
        refresh:
          type: string
        access:
          type: string
          readOnly: true
        otp_token:
          type: string
          description: "The OTP (One Time Password) token received by the user from the\n        configured Two Factor Authentication method.\n        "
      required:
      - access
      - otp_token
      - refresh
  securitySchemes:
    JWT:
      in: header
      type: apiKey
      scheme: bearer
      bearerFormat: JWT
      name: Authorization
      description: 'Authorization: Bearer xxx.xxx.xxx'
    OAuth2:
      type: oauth2
      in: header
      name: Authorization
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize/
          tokenUrl: /oauth/token/
          scopes:
            read: Reading scope
            write: Writing scope
            openid: OpenID connect
      description: 'Authorization: Bearer xxxxxxxx'
    Token:
      type: apiKey
      in: header
      name: Authorization
      description: 'Authorization: Token key_xxxxxxxx'
    TokenBasic:
      type: http
      scheme: basic
      name: Authorization
      description: '-u key_xxxxxxxx:'
x-provenance:
  method: harvested
  publisher: Karrio
  source: https://www.karrio.io/openapi.yml
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)